Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tracking Sharing TP Superfetch Log' = 'C:\vfrwfbsfct\kpkrqxq4rv.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Diagnostic Problem DNS Adaptive] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Diagnostic Problem DNS Adaptive] 'ImagePath' = 'C:\vfrwfbsfct\kpkrqxq4rv.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\vfrwfbsfct\ofbodsphqjm6
- C:\vfrwfbsfct\ofbodsphqjm6
- C:\vfrwfbsfct\pluxwn2ypkegmwoxb3wc.exe
- C:\vfrwfbsfct\kpkrqxq4rv.exe
- C:\vfrwfbsfct\hdd9bwope.exe
- C:\vfrwfbsfct\xi2shyuxvz
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\vfrwfbsfct\kpkrqxq4rv.exe
- C:\vfrwfbsfct\hdd9bwope.exe
Удаляет следующие файлы:
- %WINDIR%\vfrwfbsfct\ofbodsphqjm6
- C:\vfrwfbsfct\pluxwn2ypkegmwoxb3wc.exe
Подменяет следующие файлы:
- %WINDIR%\vfrwfbsfct\ofbodsphqjm6
Сетевая активность:
Подключается к:
- 'ka#####rajermaine.net':80
- 'co#####cegabrielson.net':80
- 'ha#####tagabrielson.net':80
- 'co######echristinsen.net':80
- 'ha######achristinsen.net':80
- 'ja#####tastephenson.net':80
- 'ro#####nestephenson.net':80
- 'cr######ncollingwood.net':80
- 'ja######acollingwood.net':80
- 'ja#####tagabrielson.net':80
- 'ro#####negabrielson.net':80
- 'ja######achristinsen.net':80
- 'ro######echristinsen.net':80
- 'ja#####ynstephenson.net':80
- 'cr#####onstephenson.net':80
- 'ro######ecollingwood.net':80
- 'ja######ncollingwood.net':80
- 'ha######acollingwood.net':80
- 'ka#####rastephenson.net':80
- 'ma#####anstephenson.net':80
- 'pr######acollingwood.net':80
- 'ma######ncollingwood.net':80
- 'pr#####lagabrielson.net':80
- 'ma#####angabrielson.net':80
- 'pr######achristinsen.net':80
- 'ha#####tastephenson.net':80
- 'co######ecollingwood.net':80
- 'ch#####tastephenson.net':80
- 'ka######acollingwood.net':80
- 'ka#####ragabrielson.net':80
- 'ch#####tagabrielson.net':80
- 'ka######achristinsen.net':80
- 'co#####cestephenson.net':80
- 'ma######nchristinsen.net':80
- 'ja#####yngabrielson.net':80
- 'cr#####ongabrielson.net':80
- 'ja######nchristinsen.net':80
- 'de#####stmackenzie.net':80
- 'la#####iawinthrop.net':80
- 'de#####stwinthrop.net':80
- 'la#####iafleurette.net':80
- 'de#####stfleurette.net':80
- 'de#####stjermaine.net':80
- 'pr#####lajermaine.net':80
- 'pr#####lamackenzie.net':80
- 'ma#####anmackenzie.net':80
- 'pr#####lawinthrop.net':80
- 'ma#####anwinthrop.net':80
- 'pr#####lafleurette.net':80
- 'ma#####anfleurette.net':80
- 'ma#####anjermaine.net':80
- 'la#####iajermaine.net':80
- 'la#####iamackenzie.net':80
- 'ch######achristinsen.net':80
- 'cr######nchristinsen.net':80
- 'cl######dchristinsen.net':80
- 'cl#####ndstephenson.net':80
- 'ch#####nestephenson.net':80
- 'cl######dcollingwood.net':80
- 'ch######ecollingwood.net':80
- 'cl#####ndgabrielson.net':80
- 'ch#####negabrielson.net':80
- 'ch######echristinsen.net':80
- 'se######nchristinsen.net':80
- 'se#####anstephenson.net':80
- 'ch#####nastephenson.net':80
- 'se######ncollingwood.net':80
- 'ch######acollingwood.net':80
- 'se#####angabrielson.net':80
- 'ch#####nagabrielson.net':80
- 'pr#####lastephenson.net':80
- 'de######tchristinsen.net':80
TCP:
Запросы HTTP GET:
- http://ka#####rajermaine.net/index.php
- http://co#####cegabrielson.net/index.php
- http://ha#####tagabrielson.net/index.php
- http://co######echristinsen.net/index.php
- http://ha######achristinsen.net/index.php
- http://ja#####tastephenson.net/index.php
- http://ro#####nestephenson.net/index.php
- http://cr######ncollingwood.net/index.php
- http://ja######acollingwood.net/index.php
- http://ja#####tagabrielson.net/index.php
- http://ro#####negabrielson.net/index.php
- http://ja######achristinsen.net/index.php
- http://ro######echristinsen.net/index.php
- http://ja#####ynstephenson.net/index.php
- http://cr#####onstephenson.net/index.php
- http://ro######ecollingwood.net/index.php
- http://ja######ncollingwood.net/index.php
- http://ha######acollingwood.net/index.php
- http://ka#####rastephenson.net/index.php
- http://ma#####anstephenson.net/index.php
- http://pr######acollingwood.net/index.php
- http://ma######ncollingwood.net/index.php
- http://pr#####lagabrielson.net/index.php
- http://ma#####angabrielson.net/index.php
- http://pr######achristinsen.net/index.php
- http://ha#####tastephenson.net/index.php
- http://co######ecollingwood.net/index.php
- http://ch#####tastephenson.net/index.php
- http://ka######acollingwood.net/index.php
- http://ka#####ragabrielson.net/index.php
- http://ch#####tagabrielson.net/index.php
- http://ka######achristinsen.net/index.php
- http://co#####cestephenson.net/index.php
- http://ma######nchristinsen.net/index.php
- http://ja#####yngabrielson.net/index.php
- http://cr#####ongabrielson.net/index.php
- http://ja######nchristinsen.net/index.php
- http://de#####stmackenzie.net/index.php
- http://la#####iawinthrop.net/index.php
- http://de#####stwinthrop.net/index.php
- http://la#####iafleurette.net/index.php
- http://de#####stfleurette.net/index.php
- http://de#####stjermaine.net/index.php
- http://pr#####lajermaine.net/index.php
- http://pr#####lamackenzie.net/index.php
- http://ma#####anmackenzie.net/index.php
- http://pr#####lawinthrop.net/index.php
- http://ma#####anwinthrop.net/index.php
- http://pr#####lafleurette.net/index.php
- http://ma#####anfleurette.net/index.php
- http://ma#####anjermaine.net/index.php
- http://la#####iajermaine.net/index.php
- http://la#####iamackenzie.net/index.php
- http://ch######achristinsen.net/index.php
- http://cr######nchristinsen.net/index.php
- http://cl######dchristinsen.net/index.php
- http://cl#####ndstephenson.net/index.php
- http://ch#####nestephenson.net/index.php
- http://cl######dcollingwood.net/index.php
- http://ch######ecollingwood.net/index.php
- http://cl#####ndgabrielson.net/index.php
- http://ch#####negabrielson.net/index.php
- http://ch######echristinsen.net/index.php
- http://se######nchristinsen.net/index.php
- http://se#####anstephenson.net/index.php
- http://ch#####nastephenson.net/index.php
- http://se######ncollingwood.net/index.php
- http://ch######acollingwood.net/index.php
- http://se#####angabrielson.net/index.php
- http://ch#####nagabrielson.net/index.php
- http://pr#####lastephenson.net/index.php
- http://de######tchristinsen.net/index.php
UDP:
- DNS ASK ka#####rajermaine.net
- DNS ASK co#####cegabrielson.net
- DNS ASK ha#####tagabrielson.net
- DNS ASK co######echristinsen.net
- DNS ASK ha######achristinsen.net
- DNS ASK ja#####tastephenson.net
- DNS ASK ro#####nestephenson.net
- DNS ASK cr######ncollingwood.net
- DNS ASK ja######acollingwood.net
- DNS ASK ja#####tagabrielson.net
- DNS ASK ro#####negabrielson.net
- DNS ASK ja######achristinsen.net
- DNS ASK ro######echristinsen.net
- DNS ASK ja#####ynstephenson.net
- DNS ASK cr#####onstephenson.net
- DNS ASK ro######ecollingwood.net
- DNS ASK ja######ncollingwood.net
- DNS ASK ha######acollingwood.net
- DNS ASK ka#####rastephenson.net
- DNS ASK ma#####anstephenson.net
- DNS ASK pr######acollingwood.net
- DNS ASK ma######ncollingwood.net
- DNS ASK pr#####lagabrielson.net
- DNS ASK ma#####angabrielson.net
- DNS ASK pr######achristinsen.net
- DNS ASK ha#####tastephenson.net
- DNS ASK co######ecollingwood.net
- DNS ASK ch#####tastephenson.net
- DNS ASK ka######acollingwood.net
- DNS ASK ka#####ragabrielson.net
- DNS ASK ch#####tagabrielson.net
- DNS ASK ka######achristinsen.net
- DNS ASK co#####cestephenson.net
- DNS ASK ma######nchristinsen.net
- DNS ASK ja#####yngabrielson.net
- DNS ASK cr#####ongabrielson.net
- DNS ASK ja######nchristinsen.net
- DNS ASK de#####stmackenzie.net
- DNS ASK la#####iawinthrop.net
- DNS ASK de#####stwinthrop.net
- DNS ASK la#####iafleurette.net
- DNS ASK de#####stfleurette.net
- DNS ASK de#####stjermaine.net
- DNS ASK pr#####lajermaine.net
- DNS ASK pr#####lamackenzie.net
- DNS ASK ma#####anmackenzie.net
- DNS ASK pr#####lawinthrop.net
- DNS ASK ma#####anwinthrop.net
- DNS ASK pr#####lafleurette.net
- DNS ASK ma#####anfleurette.net
- DNS ASK ma#####anjermaine.net
- DNS ASK la#####iajermaine.net
- DNS ASK la#####iamackenzie.net
- DNS ASK ch######achristinsen.net
- DNS ASK cr######nchristinsen.net
- DNS ASK cl######dchristinsen.net
- DNS ASK cl#####ndstephenson.net
- DNS ASK ch#####nestephenson.net
- DNS ASK cl######dcollingwood.net
- DNS ASK ch######ecollingwood.net
- DNS ASK cl#####ndgabrielson.net
- DNS ASK ch#####negabrielson.net
- DNS ASK ch######echristinsen.net
- DNS ASK se######nchristinsen.net
- DNS ASK se#####anstephenson.net
- DNS ASK ch#####nastephenson.net
- DNS ASK se######ncollingwood.net
- DNS ASK ch######acollingwood.net
- DNS ASK se#####angabrielson.net
- DNS ASK ch#####nagabrielson.net
- DNS ASK pr#####lastephenson.net
- DNS ASK de######tchristinsen.net
Другое:
Создает и запускает на исполнение:
- 'C:\vfrwfbsfct\pluxwn2ypkegmwoxb3wc.exe'
- 'C:\vfrwfbsfct\kpkrqxq4rv.exe'
- 'C:\vfrwfbsfct\hdd9bwope.exe' "c:\vfrwfbsfct\kpkrqxq4rv.exe"
